lemon-lang / lemon Goto Github PK

The size arguments of the following snprintf calls are derived from their return values, which may exceed the size of the buffer and overflow.

The return value of a call to snprintf is the number of characters that would have been written to the buffer assuming there was sufficient space. In the event that the operation reaches the end of the buffer and more than one character is discarded, the return value will be greater than the buffer size. This can cause incorrect behavior.

In line 312 of larray.c:

		length = snprintf(buffer + offset,
		                  maxlen - offset,
		                  fmt,
		                  lstring_to_cstr(lemon, string));

and
In line 357 of ltable.c:

		length = snprintf(buffer + offset,
		                  maxlen - offset,
		                  fmt,
		                  lstring_to_cstr(lemon, key),
		                  lstring_to_cstr(lemon, value));

Does the language support file io ?

In line 2300 of compiler.c:

handle = dlopen(module_path, RTLD_NOW);

Using externally controlled strings in a process operation can allow an attacker to execute malicious commands.

Possible to compile and run on linux?

Could this be possible? I've noticed that lemon depends on Linux specific libraries like select.h. Please keep in mind that all of us aren't running on the same OS as you.

What kind of memory management it uses?

In line 2310 of compiler.c:

strcpy(init_name, module_name);

This 'call to strcpy' with input from call to getenv may overflow the destination.

Hello! I would like to say i discovered this language few days ago and instantly became a fan of it because it's easy to embed and not hard to learn.

I wanted to shout out here that i'm making a .NET binding for it because C# is my main language and i'd like to use this from time to time in some projects there.

https://github.com/cartman300/lemonade

The main repository is added as a submodule and compiles in visual studio just fine with some external supporting headers and without modifying the source code. 👍

Also a side question, would it be possible to add a function similar to lemon_machine_execute and lemon_machine_execute_loop which only steps trough N machine instructions and returns back to the caller? I see this being useful when embedding the language into a video game update loop, it would prevent stuff like while (true) { } from hanging the game.

The source size exceeds the destination size by one byte, which can possibly result in a bug.

the var here adds nothing:
def hello(var name) {

Looks like Lemon is close to JS so why not to make it as a subset of JS?

In /lib/os.c:

• line 44, should be 'r=1;' instead of 'a=1;'
• line 47, I expect it to be 'w=1;r=1;'. Flag 'w' is sufficient to state O_RDWR. (Could be my fault, depends on you)

Termux don't have gcc.The only available c/cpp compiler is clang.
Current Makefile will generate an error that "couldn't find gcc-ar".
Thanks!

The functions called in these lines are consistently checked for null except in these instances. The lack of a null check could mask bugs.

All I can find is two files with less than 10 lines each.

First of all, great job; I love your coding style, it's super clean.

If I may, I would like to ask a couple of questions:

• What led you, frustrated you, or even motivated you to build a new language?
• What problems are you trying to solve?
• Is it GIL-free?
• Is it thread-safe by default?
• JIT support please?
• Any plans for generics support?

That's it for now.

Keep up the good work 👍

Lemon does not support retrieving the history via arrow keys. Is it possible to implement GNU Readline to support shell-like shortcuts?

Hey @zhicheng!
When will the documents be ready?

hey
please delete or rename

i literally built my whole personality around a language called lemon-lang and you are breaking my heart

https://github.com/imagine-hussain/lemonlang

It is based off my best friend luke-fisk-lennon who's brother died of cancer so we want to write a language in his honour :(

pls bro i beg u bro pls i am litarlly crying rn pls change name

In https://github.com/lemon-lang/lemon/blob/master/src/ltype.c#L34, you forgot to use cast(self) that you have defined 4 lines above and typecast-ed self the traditional way.

I want to translate lemon code to c code.
How can i generate c code from lemon code?

network library support ?

@zhicheng Take a look at src/lexer.c line 97.

What's that supposed to do? If it's checking for an octal, that code block should have been in line 94, correct?